Medium · 4.3 CVE-2022-36917 EUVD-2022-6310GHSA-9xhm-6w5p-335v

Jenkins Google Cloud Backup Plugin allows attackers with Overall/Read permission to request a manual backup.

Published Jul 27, 2022 · Updated Aug 3, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Google Cloud Backup Plugin Package: org.jenkins-ci.plugins:google-cloud-backup Category: Web / CMS Ecosystem: Maven

Description

A missing permission check in Jenkins Google Cloud Backup Plugin 0.6 and earlier allows attackers with Overall/Read permission to request a manual backup.

Affected products

Vendor	Product	Affected	Fixed
Jenkins project	Jenkins Google Cloud Backup Plugin	unspecified – ≤ 0.6	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.jenkins-ci.plugins:google-cloud-backup	<= 0.6	—	GHSA-9xhm-6w5p-335v

Advisories 1

WID-SEC-2022-0852 Jenkins: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 12, 2023

References

https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2656
[oss-security] 20220727 Multiple vulnerabilities in Jenkins plugins mailing-list